RIA SECURITY TECHNOLOGY Ulysses Wang Security Researcher, Websense Hermes Li Security Researcher, Websense 2009 Websense, Inc. All rights reserved.
Agenda RIA Introduction Flash Security Attack Vectors Threats In the Wild Detection PDF Security Attack Vectors Threats In the Wild Detection Conclusion Q&A 2009 Websense, Inc. All rights reserved. 2
RIA Introduction 3
Rich Internet Application Key Characteristics Deliver rich user experience Based on Internet Highly interactive 4
RIA Plugins Adobe Flash, Java and Microsoft Silverlight 5
Adobe Vulnerability 6
Attack Vectors 7
Flash Exploit 25 Flash Player Related Vulnerability 20 15 10 5 0 2001 2002 2003 2004 2005 2006 2007 2008 2009 8
Flash Exploit (cont.) 34 million swf application are vulnerable according to Websecurity 2009.12 Flash Exploit In the Wild CVE-2007-0071 CVE-2009-1862 CVE-2010-1297 9
Flash XSS Renren.com flash XSS worm 10
Flash Malvertizement Yahoo,CNN,New York Times Ad bars for products Download Rogue AV 11
Threats In the Wild 12
CVE-2007-0071 (version 1) CVE-2007-0071 May 2008 13
CVE-2007-0071 (version 2) CVE-2007-0071 Wrapped with Actionscript3 14
CVE-2007-0071 (version 2) CVE-2007-0071 Wrapped with Actionscript3 April 2009 15
CVE-2007-0071 (version 3) Wrapped with Actionscript3 and store the encrypted data in the Javascript code Phoenix exploit kit 16
CVE-2007-0071 (version 3) Phoenix exploit kit payload page flash 1. Payload page call embedded flash file 2. Flash call payload page for encrypted data 3. Payload page detect version and return encrypted data 4. Flash decode data and run cve-2007-0071 file 17
Future Trends Most dangerous is vulnerability to execute code More AS obfuscation like Javascript obfuscation Combined with Javascript more closely 18
Detection 19
Module Signature scanner Exploit scanner Actionscript scanner Scanner Honeyclient scanner 20
Signature Scanner Parse SWF format Signature base detection 21
Exploit Scanner Check DefineSceneAndFrameLabelData shellcode detection 22
Actionscript Scanner Detect suspicious Actionscript Loader.loadBytes parseint, charcodeat Too many push action Based on Websense URL database Suspicious Tag File size and Tag count 23
Honeyclient Scanner Honeyclient detection Log http traffic Monitor files, registry key values, and processes 24
PDF Security 25
PDF Security Trend PDF's CVE records 90 80 70 60 50 40 30 20 10 0 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009
Why Malware Use PDF Portable Document Format = Easy + Quick Support all platform Can email around Can work offline $ Support embedded RIA
PDF Frame %PDF-1.3 1 0 obj <</Type /Pages /Kids [3 0 R ] /Count 1 /MediaBox [0 0 595.28 841.89] >> endobj xref 0 10 0000000000 65535 f 0000000550 00000 n 0000000733 00000 n 0000000009 00000 n 0000000087 00000 n trailer << /Size 10 /Root 9 0 R /Info 8 0 R >> startxref 8983 %%EOF File Header Objects Cross-Reference Table Trailer
Filters Used in Malicious PDF ASCIIHexDecode Filter Hex encode start with # Sample: /Filter /#46#6c#61#74#65#44#65#63#6f#64#65 (FlateDecode) FlateDecode Filters Compressed stream Use zlib Crypt Filter /Filter /Standard
Encrypted PDF 14 0 obj <</R 3 Indirect Objects /P -3904 /O (6E 訚 u;?\( 鎓 Zん5?? 婼 h 撱 臂 \\W? /Filter /Standard /Length 128 Crypt Filter /V 2 /U (\r 覑 u 屴 p 袶 U 癨 r 渿 [????????????????) >> trailer <</Encrypt 14 0 R /Info 15 0 R Name Filter /Root 1 0 R /Size 16 /ID [<3249d6fe1386f4984c3df5d288c0bb49><3249d6fe1386f4984c3df5d288c0bb49>] >>
POC Demo Exploit User-Lure
How Malicious PDF Spread? SQL Injection SPAM Botnet Zbot etc. Exploit Kit
Attack Time Line Mass Injections Trigger Exploit Install Clients Spread to Others Spam Emails Src=http://ip/pdf.js Goto http://xxx.com virus.pdf virus.swf Shellcode Infostealer.exe botclient.exe smtphost.dll other.dll Spam IMs Spams Inject Hosts Hxxp://ip/trojan.exe 2009 Websense, Inc. All rights reserved. 35
Weak of AV /Filter /#46#6c#61#74#65#44#65#63#6f#64#65 >> Stream x 趠?n? 噍 ю\??y? N 缮 茄 χhs 豛?? Embeded a bad pdf into a good pdf AV signatures Threat categories
Examples 2009 Websense, Inc. All rights reserved. 37
How to Detect + + + Rules Signatures Heuristics Application Behaviors JBIG2Decode FlateDecode ASCIIHEX ASCII85 Decode Input Decrypt Deobfuscate Scan Output Javascript RC4 MD5 Unescape Eval Regex
Malicious Content Stripping Web Security Gateway Active Security Module Content Gateway Module Email security Module Remove malicious Script, ActiveX etc. and display safe content
Other Solutions Server Side Display Virual client / Sandbox
Portable RIA
PDF Portfolio
PDF Portfolio Scan Embedded Files Stripping Pictures Portfolio Multimedia Documents
THANKS June 2010